[Bro-Dev] TCP RTT estimation

[Juhoon Kim]

> > The idea what I have about RTT is measuring a gap between the time a
> > segment is seen and the time a segment directly after the corresponding
> > ack is seen in the monitoring point. 
> 
> Can you sketch in more detail (with an example) what you have in mind?
> (I've been down this path in the past, and it gets pretty complex!)

Sorry, my description was not clear enough. Following is an RTT what we
want to measure.

[Sender]        [Monitor]-------------(a)------>[Receiver]
[Sender]<-------[Monitor]<--------ack-of-(a)----[Receiver]
[Sender]------->[Monitor]

While Katrina's RTT estimation seems like following:

[Sender]        [Monitor]-------------(a)------>[Receiver]
[Sender]        [Monitor]<--------ack-of-(a)----[Receiver]

> Also, what's your ultimate goal: path/performance characterization?
> Katrina's is more focused on trouble-shooting, so finding exceptional
> values rather than (for example) accurately tracking the RTO computation.

Yes, our goal is to measure the performance of TCP flows. That's why we
want to measure RTT as accurate as possible. 

Juhoon